# Changelog ## 0.1.4 - 2026-08-20 ### Fixes - Made supervised-worker spawn budgets optional at the tool boundary; omitted budgets now use the shipped finite ceiling defaults, including 64 MiB output, instead of forcing callers into small ad hoc values. - FleetView now renders `done`, `failed`, and `cancelled` as distinct terminal worker states and prunes cancelled workers after a short retention window. - Launch and Fleet detail overlays now request keyboard focus; launch preview also renders inside a bordered overlay. - Dormant AMQ transport no longer reserves persistent TUI footer space while RPC status remains inspectable. ## 0.1.1 - 2026-08-20 ### Fixes - Fixed supervised-worker startup on macOS when `ps comm` reports a PATH-launched current process as a relative name such as `pi`; current-process identity now safely falls back to Node's absolute `process.execPath`, while unrelated PIDs remain fail-closed. ### Transport slice - Provenance: implemented against the accepted design, current AMQ source, and live pi/AMQ interaction evidence recorded in `docs/design.md`. - Delivery phases: adapter and confirmed binding/bootstrap; receiver lease and journal; pump, priority scheduling, and recovery; typed tools, lifecycle integration, guidance, and FleetView projection. - Conformance: 40 implemented, 8 partially implemented, and 1 deferred; 49 total design cases. - Guidance: the transport appends a static AMQ doctrine and the coordination skill now covers both existing peers and supervised worker fan-out. W1 through W4 are recorded below; full worker-session takeover remains gated. ### Fresh-session automation - Raised the supported pi floor to **0.84.2** (no version gate, no fallback): `expandPromptTemplates` and command-context session control (`ctx.waitForIdle`/`ctx.newSession`/`withSession`) are both released there. Removed the 0.84.1 compatibility constant and capability stub. - Implemented the automatic fresh-session dispatch sequence from `docs/design.md` §8.3 end to end: authorized envelopes now dispatch a hidden `/amq-new-task` command via `sendUserMessage({expandPromptTemplates: true})`; the command handler waits for idle, replaces the session with `ctx.newSession`, seeds AMQ provenance via `setup`, sends the bounded kickoff envelope via `withSession`, and verifies the kickoff before recording `injected`. - Accounted for pi's lazy session-file durability: a fresh session's file is not written until its first assistant entry, so a kickoff that is not yet disk-visible but is confirmed present in the replacement session's in-memory branch is a legitimate deferred `dispatched` outcome (`diskVisible: false`), not a failure. The bridge journal already models this correctly — the pending record's target session commits immediately and `injected` is recorded only once reconciliation observes the flushed projection. - A command-handler dispatch that never fires, a cancelled replacement, or a kickoff missing from both the in-memory session and disk now surfaces as a real failure and leaves the record `pending` with `/amq ingest` guidance, instead of a permanent version-limitation notice. ### WorkerRuntime W1 - Added the pi-owned workspace-scoped run store outside `AM_ROOT`, with immutable chained events, rebuildable snapshots, idempotent `startRun`, actual-call IDs, worker contracts, and durable ambiguity/reconciliation state. - Added generation-fenced supervisor and canonical worker-session leases carrying PID/start/boot evidence. Timeout and age never prove death; stale release cannot remove a replacement. - Added pure-state fault tests for restart projection, chain corruption, supervisor fencing, session exclusivity, generation-safe stale-owner takeover, and transport/workflow persistence isolation. No subprocess or model tool surface is included in W1. ### WorkerRuntime W2 - Added exact schema-1 send-only launch contracts for one-shot JSON and long-lived RPC pi workers, including model/thinking/cwd/tool/capability/trust parity and receiver-authority environment scrubbing. - Added deterministic per-worker session directories, pre-spawn session reservations promoted atomically to child PID/start/boot/executable ownership, and generated session-file evidence from the child-ready handshake. - Added append-only attempt start/ready/usage/exit, budget, cancellation, needs-attention, and ambiguity projections. Worker/concurrency/depth/attempt/token/wall-clock ceilings are enforced before spawn or from observed usage. - Added parent-liveness FD fencing, POSIX process-group TERM/KILL cleanup, cancellation-intent-before-signal ordering, authoritative-exit-before-explicit-resume, and restart reconciliation with no automatic process replay. - Added fault-sensitive fake-process tests plus real subprocess tests for the parent-liveness pipe, descendant process-group signaling, and platform PID/start/boot identity. At the W2 checkpoint this layer remained internal; W3 registers the model tools below. ### WorkerRuntime W3 - Added the exact seven-state worker attempt lifecycle (`pending`, `running`, `blocked`, `ambiguous`, `done`, `failed`, `cancelled`) and one data-driven legality table. `done` is guarded by evidence, optional report shape, optional executable check, optional human approval, and budget. - Added typed `spawn_worker`, `list_workers`, `collect`, `cancel`, `steer`, and `revise_contract` tools independent of AMQ binding. Model tiers are selected mechanically from the live catalog with current-model fallback and auditor capability flooring. - Added immutable contract revisions with durable `pending -> delivered` visibility. RPC revisions wait for the next inference boundary and never interrupt the in-flight inference. - Added `stall.silent` and exact structured-payload `stall.no_progress` ledger facts, surfaced through `list_workers` and FleetView without automatic nudge, retry, redelivery, or termination. - Added canonical head/tail prompt capsules, trusted model-notes overlays, shape-only report schema validation, recorded acceptance-check exit status, and fail-closed headless human approval. ### WorkerRuntime W4 - Added distinct data-driven worker-attempt and run Gate tables, terminal-fact precedence, running-only stall observations, detached-control recovery, and fail-closed reconciliation. PID disappearance, timestamps, result files, and lease-directory absence never synthesize worker exit. - Added explicit serializable `limited(value)`/`unlimited` budgets for every run and worker dimension, pre-effect TUI confirmation for unlimited run ceilings, headless refusal, monotonic accounting, and finite observation cadence for unlimited wall-clock. - Added authoritative FleetView worker rows and session tails, generation-fenced RPC steer and `x,x` cancellation, fresh-session replacement interlock, derived lifecycle projections, and quiet grouped success versus immediate failed/paused/ambiguous UI notices. - Added bounded child-protocol handling: structured 4 MiB JSONL line failures, 128 KiB stderr tails, split-UTF-8 and final-unterminated-line tolerance, and generation-correlated `agent_settled` revision release. - Added the named `WORKER_TEAM_DOCTRINE`, independently removable doctrine regressions, refreshed coordination references, and the zero-AMQ three-worker conformance demonstration. The operational governance model remains exactly Contract, Ledger, Lease/launch, Gate, and Delivery. ### WorkerRuntime V1.1 hardening - Added deliberate `spawn_worker.continue_worker_id` continuation: only a terminal worker with durable exit evidence and non-live/non-unknown process identity may yield its exact Pi session file. The successor keeps a fresh contract and worker identity, records prior worker/attempt/session/lease provenance, reacquires the canonical session lease under a fresh generation, and mirrors the continuation fact in the prompt capsule. - Added explicit workflow cleanup through `cleanup_runs` and `/pi-amq-cleanup`. Dry-run is the default and reports per-run, worker-session, and artifact sizes; deletion requires TUI confirmation or headless `--yes`, runs under the current supervisor fence, skips active, ambiguous, held, or corrupt ownership, and records a persistent audit event before removing any candidate. - Added read-only `workflow_doctor` and `/pi-amq-doctor` diagnostics for corrupt run ledgers, ledger/process mismatches, orphan processes, stale, abandoned, or corrupt worker-session leases, dangling session directories, and top-level disk usage. Findings carry exact argv-style inspection or quarantine suggestions; doctor never executes a fix. - Added one private shared artifact directory per run. The runtime creates it deterministically beside the run ledger, injects it as the first artifact context ref in every worker contract, mirrors it in the worker prompt capsule, returns it in worker projections, and teaches workers to use exact paths for file handoffs. Cleanup remains explicit. - Added named cost and output-byte budget fault tests. Every observed budget breach now persists the latest monotonic usage and cancellation intent before process-group signaling, so the ledger contains both the trigger value and enforcement reason. - Closed hard-budget conformance across every run ceiling. Max-worker and total-attempt exhaustion now have literal no-process, no-ledger-side-effect tests alongside the existing concurrency, depth, token, wall-clock, cost, and output-byte evidence. - Added the complete required-field spawn omission matrix across ledger, worker-session lease, and process effect ports; mutation-grant authority remains explicitly partial. Closed parent-death/stale-output conformance with an end-to-end old-generation mutating-worker result rejection after supervisor takeover. - Added the adjudicated V2 roadmap and an advisory doctrine requirement for a complementary-model reviewer or oracle after material repository edits. The Gate remains authoritative; no automatic watchdog, new state, or Delivery verb was introduced. - Added deliberate worker context selection. `fresh` remains the default; `fork` snapshots the driver current leaf into an independent worker session, records parent/branch/size provenance in the immutable ledger, displays inherited size in launch preview, and verifies the parent file is byte-identical after the copy. - Added bounded ordered model fallback. Only child launch-validation and classified provider auth, quota, or capacity failures advance the chain; every selected model and reason is ledgered before launch, ordinary failures never advance, exhausted chains stay failed, and Fleet/tool projections expose tier degradation. - Added bounded directional peer messaging for RPC workers. `message_worker:` grants map only to a child tool, require an exact or uniquely resolved recipient, route through the supervisor at the recipient inference boundary, and publish one generation-fenced correlated message audit under both endpoint projections. No driver verb or mutable topology was added. - Added generation-correlated typed waits for RPC workers. The child-only `wait_for_input` tool ledgers `{reason, correlation}` and moves the current generation from running to blocked through Gate; only an exact-correlated steer, contract revision, or peer delivery wakes it. Natural-language questions and `message_end` do not change wait state, blocked workers do not accrue stall observations, and Fleet/tool projections expose the wait facts without adding a driver verb.